Enhancing Adversarial Robustness in Network Intrusion Detection: A Layer-wise Adaptive Regularization Approach

Technical Summary: Enhancing Adversarial Robustness in Network Intrusion Detection via LARAR

Problem Statement
Network Intrusion Detection Systems (NIDS) based on deep learning are increasingly vulnerable to adversarial attacks, where imperceptible perturbations to input data cause misclassification. While state-of-the-art adversarial training methods have improved robustness, they suffer from significant limitations: they treat neural networks as "black boxes," applying uniform regularization across all layers without understanding how adversarial perturbations propagate or amplify through specific hidden layers. This lack of layer-wise insight prevents targeted defense strategies, leading to inefficient resource allocation and a lack of interpretability regarding which parts of the network are most susceptible to attack. Furthermore, existing methods often fail to detect adversarial samples early in the inference process.

Methodology: The LARAR Framework
The paper proposes LARAR (Layer-wise Adversarial Robustness using Adaptive Regularization), a framework designed to extend conventional adversarial training with three core innovations:

1. Layer Vulnerability Score (LVS) Metric:
   The authors introduce a quantified metric to measure the sensitivity of each hidden layer to adversarial attacks. LVS is calculated as the normalized difference between clean and adversarial activations for a given layer $l$:
   $$LVS(l) = \frac{1}{B} \sum_{i=1}^{B} \frac{\|h^{(l)}(x_{adv}^i) - h^{(l)}(x_i)\|_2}{\|h^{(l)}(x_i)\|_2 + \epsilon_{small}}$$
   This metric identifies which layers amplify perturbations, providing interpretability into the internal flow of adversarial noise.

2. Adaptive Layer-wise Regularization:
   Unlike traditional approaches that apply uniform penalties, LARAR employs a composite loss function that includes a learnable, layer-specific regularization term. The total loss ($L_{total}$) combines Cross-Entropy Loss ($L_{CE}$), Auxiliary Loss ($L_{aux}$), Gradient Alignment Loss ($L_{GA}$), Feature Smoothing Loss ($L_{FS}$), and the adaptive LVS term:
   $$L_{total} = L_{CE} + \lambda_{aux}L_{aux} + \lambda_{GA}L_{GA} + \lambda_{FS}L_{FS} + \beta \sum_{l=1}^{L} w^{(l)} \cdot LVS^{(l)}$$
   The weights $w^{(l)}$ are learnable parameters updated via gradient descent. This allows the model to automatically allocate stronger regularization to layers with higher empirical vulnerability (high LVS) and reduce it for robust layers.

3. Multi-Level Supervision and Early Detection:
   The framework integrates Auxiliary Classifiers (single linear layers) at intermediate hidden layers to provide multi-level supervision, strengthening feature representations before the final output. Additionally, the system establishes statistical detection thresholds ($\tau^{(l)}$) based on the mean and standard deviation of LVS values from clean validation data. If the LVS of an input at any layer exceeds its threshold, the sample is flagged as adversarial, enabling early exit and detection before the final classification layer.

Experimental Setup
The framework was evaluated on the UNSW-NB15 dataset, a benchmark for network intrusion detection containing 82,332 samples with 42 features. The baseline model consisted of a two-layer MLP (128 and 64 dimensions) with ReLU activations and batch normalization. The authors compared LARAR against a standard Vanilla NN and a Base ADVNN (a state-of-the-art adversarial training method without layer-wise analysis). The evaluation included clean accuracy and robustness against Fast Gradient Sign Method (FGSM), Projected Gradient Descent (PGD), and transfer attacks.

Key Results

• Robustness Improvement: LARAR achieved a clean accuracy of 95.01%. Under adversarial conditions, it demonstrated significant improvements over the Base ADVNN:
  • FGSM: 31.45% accuracy (vs. 27.00% for Base ADVNN), a 16.4% improvement.
  • PGD: 33.18% accuracy (vs. 28.70% for Base ADVNN), a 15.6% improvement.
  • Transfer Attacks: 42.51% accuracy (vs. 38.29% for Base ADVNN), an 11.02% improvement.
• Attack Success Rate (ASR): LARAR reduced the success rate of attacks by approximately 4.2% to 4.4% compared to the Base ADVNN across all attack types.
• Layer Analysis: The LVS metric revealed that the first hidden layer was consistently more vulnerable than the second. The adaptive weights successfully converged to assign higher regularization pressure to the more vulnerable layer, validating the mechanism's ability to prioritize defense resources.
• Efficiency: While LARAR introduced an 18% computational overhead in training time compared to Base ADVNN (due to LVS computation and auxiliary losses), it maintained the same inference time (0.8 ms) during normal operation. With early detection enabled, inference time could be reduced by 25% for confidently classified samples.

Significance and Claims
The paper claims that LARAR addresses the "black box" limitation of current adversarial defenses by providing interpretable, layer-wise vulnerability scores. This granularity allows for:

1. Targeted Defense: Allocating computational resources specifically to the most vulnerable layers rather than applying uniform regularization.
2. Early Detection: Identifying adversarial samples at intermediate layers, potentially reducing latency and computational load during inference.
3. Design Insight: Offering actionable data for security practitioners to understand how perturbations propagate, suggesting that early-stage feature extractors require specific hardening.

The authors conclude that while LARAR incurs a modest training overhead, the trade-off is justified by the substantial gains in robustness and the enhanced interpretability of the defense mechanism. The work positions LARAR as a step toward more principled, transparent, and efficient adversarial defense in NIDS.